AI-powered system for creating structured, balanced performance reviews, self-assessments, 360° feedback, and calibration notes across review cycles.
Security Analysis
high confidenceThe skill is an instruction-only performance-review template pack that matches its description and requests no credentials or installs; the primary risk is handling sensitive HR data at runtime, not incoherence in the package itself.
Name and description match the SKILL.md and README content: templates, frameworks, and prompts for self-assessments, manager reviews, 360° feedback, calibration, and development plans. The skill requests no unrelated binaries, env vars, or config paths.
SKILL.md contains templates, frameworks, prompts, and checklists only — no shell commands, file reads, or explicit network endpoints. However the content is designed to collect and synthesize 360° feedback and calibration data (sensitive employee information). The instructions do not specify how to collect/store that data or what external endpoints to use, so actual data flow depends on the agent's integrations/permissions at runtime.
No install specification and no code files — instruction-only. Nothing is written to disk or downloaded by the skill itself, which minimizes technical attack surface.
The skill declares no required environment variables, credentials, or config paths. There are no disproportionate secret requests relative to the stated HR review functionality.
always is false and the skill uses normal autonomous-invocation defaults. It does not request persistent system-wide changes or access to other skills' configs.
Guidance
This skill is coherent and low-risk from a package/installation standpoint because it's instruction-only and asks for no credentials. The main concern is sensitive HR data: do not feed real PII, salaries, or confidential performance details into the skill unless you verify which integrations the agent will use (email, Slack, HRIS, storage) and you trust those connections and retention policies. Test with dummy data first, limit the agent's permissions (sandbox/email drafts rather than sending), review any external links or paid add-ons before sharing data, and ensure compliance with your company's privacy and HR policies.
Latest Release
v1.1.0
Expanded OBSERVE framework, calibration bias checklist, delivery conversation scripts, legal compliance section
More by @1kalin
Published by @1kalin on ClawHub
